vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-07-09 16:00:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

Harden provider MSP tenant isolation

Browse source 
- isolate provider MSP tenant runtimes onto per-client Docker networks
- add adversarial proofs for workspace cap races, handoff retargeting, and org-bound agent report retargeting
- pin provider deploy proof to start Traefik before tenant network creation
This commit is contained in:
rcourtman 2026-06-02 17:34:10 +01:00
parent 473a0ddee6
commit d729461cad
15 changed files with 697 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

1
cmd/pulse-control-plane/provider_msp_preflight.go
View file

@ -186,6 +186,7 @@ func providerMSPDockerManagerConfig(cfg *cloudcp.CPConfig) cpDocker.ManagerConfi
return cpDocker.ManagerConfig{
Image: cfg.PulseImage,
Network: cfg.DockerNetwork,
IsolateTenantNetworks: true,
BaseDomain: providerMSPBaseDomainFromURL(cfg.BaseURL),
TrialActivationPublicKey: cfg.TrialActivationPublicKey,
TrustedProxyCIDRs: cfg.TrustedProxyCIDRs,